Help my Linksys WRT54G router was broken into using the "curl" command

Jeff Liebermann <(E-Mail Removed)> wrote in
news:(E-Mail Removed):

> John Gray <(E-Mail Removed)> hath wroth:
>
>>Jeff Liebermann <(E-Mail Removed)> wrote in
>>news:(E-Mail Removed) m:
>>> My experiences with v5 and v6 WRT54G routers has been limited and
>>> dismal. That's because I've exchanged or sold every one that I've run
>>> into.
>>>
>>> DD-WRT works on v5, v6, and v7. I tried it on several v5 routers and
>>> found no improvment to the chronic hangs and disconnects.
>>> <http://www.dd-wrt.com/wiki/index.php/Linksys_WRT54G/GL/GS/GX>
>>> <http://www.dd-wrt.com/wiki/index.php...ter_Informatio
>>> n> There's some work being on on v7 and v8 but all I've seen is:
>>> <http://wiki.openwrt.org/OpenWrtDocs/Hardware/Linksys/WRT54G>
>
>>The DD-WRT firmware that will install on the newer WRTs is a micro
>>version with much of the added functionality available in the larger
>>DD-WRT firmware removed, among other changes.
>
> Correct. See table of features at:
> <http://www.dd-wrt.com/wiki/index.php/What_is_%22DD-WRT%22%3F>
> The only version that works is the Micro version for V5 and V6.
> Note that the feature for the micro is about the same as what you get
> with the stock Linksys firmware with RADVD added. It's the added
> features that make DD-WRT and OpenWRT attractive (to me). In
> addition, installing DD-WRT on v5 and v6 routers is somewhat of an
> ordeal. Not recommended.
>
> Incidentally, you brought up the problems with v5 and v6 in this
> discussion. Why?

Actually, I mentioned it due to DD-WRT being recommended in this thread.
I'd researched this when I was in the market for a WRT54 for a neighbor. I
found a page that listed the various hardware differences between the
versions. Most informed sources I visited recommended finding the earlier
versions.

<http://en.wikipedia.org/wiki/WRT54G#Hardware_and_revisions>

>>A year ago, I had to search the local retail stores to find an older
>>WRT54 that had the Linksys Linux firmware. I finally gave up and got
>>the friend a WRT54GS in order to stay away from VXWorks and to have more
>>ram and rom available. He'll never use the GS speed on WiFi.
>
> Walmart was selling WRT54Gv4 routers until just recently, when they
> finally ran out. I switched to Buffalo routers for new installations.
> They have the same processor and memory as the Linksys v4, but IMHO
> are a better device. No problem with supply yet, but the recent
> injunction for patent infringement may eventually cause problems. Also
> note that there are a very large number of other boxes that will run
> DD-WRT or OpenWRT.
> <http://www.dd-wrt.com/wiki/index.php/Supported_Devices>

The WRT300N looks promising.

>>> Agreed. Facts, details, references, anecdotes, analysis, and sometime
>>> my opinions create considerable friction. I'll try to limit myself to
>>> tactful generalizations, respectful sympathy, and perhaps one line
>>> replies.
>
>>One line replies don't suffice either. Evidently that's all it took to
>>trip your trigger.<G>
>
> Well, I'm having a rather bad time of it lately. It started with a
> bad day, then a bad week, and may soon turn into a bad month. Try not
> to take my vicious attacks personally. I've been snarling at everyone
> lately but should be back to my normal level of hostility in about a
> month.
>

We all have days like that. I've had to delay responding sometimes. On
reading the post later that I was going to reply to, my outlook or take on
what and why something was written often changes. Often, what one means to
say is interpreted incorrectly, either due to bad composition or the
reader's different POV or baggage. We all have baggage, and not all if it
is helpful experience all the time.

A shot of Jack Daniels at bedtime may help. Just don't overindulge.<G>
Hangovers don't help one's disposition. As for me, I'm just a 'ray of
sunshine'.<G>

--
John Gray

If you don't have a reason, at least have an excuse.

John Gray <(E-Mail Removed)> hath wroth:

>Actually, I mentioned it due to DD-WRT being recommended in this thread.

I just checked all my postings on the topic. I did mention DD-WRT as
she wanted to change the login name as well as the password. It's not
exactly a recommendation. See:
<http://groups.google.com/group/alt.internet.wireless/msg/866ce8f64b85b329>

"Other routers allow additional users and even
user levels, such as read-only users. If you really
want this feature, the alternative firmware (DD-WRT,
OpenWRT) all have additional users. However, again,
this is nothing but security by obscurity and doesn't
provide any real security."

For a moment there, I thought I had made a mistake. Whew...

>> <http://www.dd-wrt.com/wiki/index.php/Supported_Devices>
>
>The WRT300N looks promising.

v1 only. v2 doesn't play (as a friend recently discovered the hard
way). He bricked it so well that I had to use the JTAG firmware load
in order to recover. See "blacklist" at:
<http://www.dd-wrt.com/wiki/index.php/Known_incompatible_devices>
Also, the WRT300N v1 requires DD-WRT v24, which is still very beta.

>We all have days like that. I've had to delay responding sometimes. On
>reading the post later that I was going to reply to, my outlook or take on
>what and why something was written often changes. Often, what one means to
>say is interpreted incorrectly, either due to bad composition or the
>reader's different POV or baggage. We all have baggage, and not all if it
>is helpful experience all the time.

Yep. I have all that and more. Add massive confusion on my part as
to the topic of discussion precipitated by posting to perhaps 12
different but similar threads every day. It's really difficult to
keep them straight. Re-reading the previous postings is required, but
I still manage to mix things up. Add to that medical problems,
problems with the ladyfriend(s), customers from hell, and gaining some
more surplus mass around the waist. I also don't bother doing battle
with myself (I always lose) or apply much tact when answering
questions. The results are predictable.

>A shot of Jack Daniels at bedtime may help. Just don't overindulge.<G>
>Hangovers don't help one's disposition. As for me, I'm just a 'ray of
>sunshine'.<G>

I don't drink. It's not anything religious, moral, or ethical. I
simply have low dissipation and can't handle booze very well. I also
have one drunk and one recovering alcoholic in the family, and I don't
want to end up like them.

Time to take out my aggressions on the piano (synthesizer) instead of
the newsgroup.


--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

Hi, my name is Adrian, and i`m interestin in how to use curl command
to break the password and login to the wrt54g LINKSYS acces point, i
dont know the version of firmware but i think is the same like yours,
i need help because i thing someone change my password administrator.
Plis send a reply as soon as posible.

ATTE. Adrian



kev wrote:
> Debbie Hurley wrote:
> > It's way too easy to break into the Linksys WRT54G router!
> >
> > Instantly bypassing the administrator password, my fifteen-year old
> > neighbor broke into my Linksys WRT54G router (firmware revision v1.0.0.6)
> > in ten seconds simply by sending this one "curl" command to it via the
> > Internet from his home next door!
> >
> > c:\> curl -d "SecurityMode=0&layout=en" http://192.168.0.1/Security.tri
>
> Unless I am getting old then if he posted this command via the Internet
> it would have got him nowhere. The curl -d command would post the data
> to 192.168.0.1 which is not a public IP address available on the
> Internet and would have have given him a timeout, unless his router
> address is 192.168.0.1.
> >
> > This kid was kind enough to knock on my door today to tell me to fix it.
> >
> > I invited him in, and from inside my own house, he showed me the Linksys
> > WRT54G command above which immediately disabled all my wireless security
> > WITHOUT him having to enter any password!
>
> For him to use this command on your computer implies you are using a
> Linux distribution and have installed curl and should know what it is
> capable of doing.
> http://curl.haxx.se/docs/manpage.html#URL
> >
> > He showed me how to disable remote administration but he said the
> > vulnerability still exists until I get a new router. I can't believe
> > everyone with a Linksys WRT54G router is throwing it in the garbage.
> >
> > Where/how can I find a firmware update that protects me from this
> > vulnerability?
> >
> >
> >
> >
> >

zacek wrote:
> Hi, my name is Adrian, and i`m interestin in how to use curl command
> to break the password and login to the wrt54g LINKSYS acces point, i
> dont know the version of firmware but i think is the same like yours,
> i need help because i thing someone change my password administrator.
> Plis send a reply as soon as posible

Regardless of the firmware (which can be found on the back label), it can
be reset.

Hold down the reset button for at least a full 30 seconds. This will
default your router to factory settings, including the password. Of course,
you'll have to reset all your custom settings.

It IS *your* router, right?

Jeff Liebermann <(E-Mail Removed)> wrote in
news:(E-Mail Removed):

>>> <http://www.dd-wrt.com/wiki/index.php/Supported_Devices>
>>
>>The WRT300N looks promising.
>
> v1 only. v2 doesn't play (as a friend recently discovered the hard
> way). He bricked it so well that I had to use the JTAG firmware load
> in order to recover. See "blacklist" at:
> <http://www.dd-wrt.com/wiki/index.php/Known_incompatible_devices>
> Also, the WRT300N v1 requires DD-WRT v24, which is still very beta.
>

Thanks. If I was in a buying mode, I'd be hunting for such articles for a
couple of weeks minimum before committin to a decision. No decision comes
lightly for me.


--
John Gray

If you don't have a reason, at least have an excuse.

On Jul 8, 11:44 pm, John Gray <nos...@invalid.com> wrote:

>
> >>The DD-WRT firmware that will install on the newer WRTs is a micro
> >>version with much of the added functionality available in the larger
> >>DD-WRT firmware removed, among other changes.

>
> The WRT300N looks promising.

Am I missng something here? Isn't the WRT54GL the one they now sell
specifically for those who want to use replacement firmware? Not
castrated and simple to change FW.

If one must have a new linksys running DD-WRT, that's the one to
get.

Steve

seaweedsteve <(E-Mail Removed)> wrote in
news:(E-Mail Removed) ups.com:

> On Jul 8, 11:44 pm, John Gray <nos...@invalid.com> wrote:
>
>>
>> >>The DD-WRT firmware that will install on the newer WRTs is a micro
>> >>version with much of the added functionality available in the larger
>> >>DD-WRT firmware removed, among other changes.
>
>>
>> The WRT300N looks promising.
>
> Am I missng something here? Isn't the WRT54GL the one they now sell
> specifically for those who want to use replacement firmware? Not
> castrated and simple to change FW.
>
> If one must have a new linksys running DD-WRT, that's the one to
> get.
>
> Steve

That was the one that Cisco came out with after it neutered the WRT54G by
reducing the rom flash and buffer memory as well as switching to VXWorks
firmware. It was in response to customer complaints of removal of the
Linux open source firmware that could be rewritten for the DD-WRT and other
third party firmware. With the new rom size, it wouldn't fit anyway.

--
John Gray

If you don't have a reason, at least have an excuse.

On Fri, 13 Jul 2007 13:10:49 -0700, seaweedsteve
<(E-Mail Removed)> wrote:

>> The WRT300N looks promising.

>Am I missng something here?

Yes.

>Isn't the WRT54GL the one they now sell
>specifically for those who want to use replacement firmware? Not
>castrated and simple to change FW.

Nope. The WRT54GL is identical to the reduced flash/RAM WRT54G v4. It
was Linksys knee jerk reaction to general disgust over the v5 and v6
mutations. Of course, they raised the price at the same time. To
underscore Linksys commitment to open source, they came out with the
WRT54 v8 which so far can't run Linux, and has non-removeable
antennas.

>If one must have a new linksys running DD-WRT, that's the one to
>get.

Nope. Many people working on open source alternatives have given up
on the WRT54G/GS line for the aformentioned reasons. Meanwhile,
DD-WRT and OpenWRT have been ported to a growing number of other
devices, which are not as disgusting as the WRT54G v5, v6, and v7. For
example, I've been using mostly Buffalo products and have not
regretted the change.

<http://www.dd-wrt.com/wiki/index.php/Supported_Devices>
<http://wiki.openwrt.org/TableOfHardware>


Free advice: Never try to oil a power supply fan while it's running.



--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831-336-2558 (E-Mail Removed)
# http://802.11junk.com (E-Mail Removed)
# http://www.LearnByDestroying.com AE6KS

Jeff Liebermann <(E-Mail Removed)> wrote in
news:(E-Mail Removed):

> On Fri, 13 Jul 2007 13:10:49 -0700, seaweedsteve
> <(E-Mail Removed)> wrote:
>
>>> The WRT300N looks promising.
>
>>Am I missng something here?
>
> Yes.
>
>>Isn't the WRT54GL the one they now sell
>>specifically for those who want to use replacement firmware? Not
>>castrated and simple to change FW.
>
> Nope. The WRT54GL is identical to the reduced flash/RAM WRT54G v4. It
> was Linksys knee jerk reaction to general disgust over the v5 and v6
> mutations. Of course, they raised the price at the same time. To
> underscore Linksys commitment to open source, they came out with the
> WRT54 v8 which so far can't run Linux, and has non-removeable
> antennas.

The V4 only changed the chipset to a Broadcom BCM5352EKPB Chipset. It has
the same rom and ram as previous versions. V5 and above did that. The GL
has the same rom and ram as the WRT54G V1 thru V4 according to this site.

http://en.wikipedia.org/wiki/WRT54G#..._and_revisions


>>If one must have a new linksys running DD-WRT, that's the one to
>>get.
>
> Nope. Many people working on open source alternatives have given up
> on the WRT54G/GS line for the aformentioned reasons. Meanwhile,
> DD-WRT and OpenWRT have been ported to a growing number of other
> devices, which are not as disgusting as the WRT54G v5, v6, and v7. For
> example, I've been using mostly Buffalo products and have not
> regretted the change.
>
> <http://www.dd-wrt.com/wiki/index.php/Supported_Devices>
> <http://wiki.openwrt.org/TableOfHardware>
>
>
> Free advice: Never try to oil a power supply fan while it's running.
>
>
>



--
John Gray

If you don't have a reason, at least have an excuse.

John Gray <(E-Mail Removed)> hath wroth:

>Jeff Liebermann <(E-Mail Removed)> wrote in
>news:(E-Mail Removed) :

>>>Isn't the WRT54GL the one they now sell
>>>specifically for those who want to use replacement firmware? Not
>>>castrated and simple to change FW.
>>
>> Nope. The WRT54GL is identical to the reduced flash/RAM WRT54G v4. It
>> was Linksys knee jerk reaction to general disgust over the v5 and v6
>> mutations. Of course, they raised the price at the same time. To
>> underscore Linksys commitment to open source, they came out with the
>> WRT54 v8 which so far can't run Linux, and has non-removeable
>> antennas.
>
>The V4 only changed the chipset to a Broadcom BCM5352EKPB Chipset. It has
>the same rom and ram as previous versions. V5 and above did that. The GL
>has the same rom and ram as the WRT54G V1 thru V4 according to this site.
>
>http://en.wikipedia.org/wiki/WRT54G#..._and_revisions

From the same article at:
<http://en.wikipedia.org/wiki/WRT54G#Hardware_versions_affect_firmware_compatibi lity>
"To support third-party firmware, Linksys has re-released the
WRT54G v4, under the new model name WRT54GL (the 'L' in this
name allegedly stands for 'Linux')."
My inspection of both boards shows that the v4 and GL are identical
inside. However, that was a while ago and the GL may have mutated in
the meantime.


--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558